[huangruiteng]

Goal And Delivered Outcome

The architecture RFC describes controller work control but leaves worker-session discovery and ordinary workspace read/write implicit. This maintainer-requested clarification makes both capabilities explicit in the English and Chinese RFC, topology, role table, acceptance matrix and C3 delivery boundary.

The controller can locate its unit's real worker bindings and inspect authorized session evidence on demand. Both roles use the same authorized workspace, toolchain and artifacts. Current Host observations remain separate from optional historical recall, and ordinary tools retain Core isolation and coordinated write ownership.

• Intended base: main at 809125511cad12db4fcd2c09bee999ec5ad2896c.
• Related: Unify Turn role execution and define one runtime entry for heartbeat and products #8484. No implementation or parent-program completion is claimed.

Author Declaration

• Written by: model_agent — OpenAI Codex, GPT-6 family.

Implemented against

The maintainer's documentation request is the basis for the new clarification. Existing boundaries come from docs/architecture/rfcs/controller-executor-unified-contract-v0.md §§5, 7, 9 and 11 at the base above.

Criterion	Disposition	Path / section	Validation
Document worker-session discovery and inspectable evidence	implemented	Both RFC mirrors, #worker-session-discovery	Semantic mirror review; anchors/provider links checked
Document controller read/write in the worker environment	implemented	Both mirrors, #shared-workspace-and-tools, topology and C3	Bidirectional read/write acceptance and ownership/privacy negative cases reviewed
Preserve role, permission and compatibility boundaries	implemented	Existing lifecycle text plus §9	Core isolation, archive scope, revocation, stale generation, environment mismatch and conflicting-write cases retained

Scope And Continuation

Complete within the requested documentation scope. Session discovery and shared-environment requirements remain proposed; runtime delivery and native-host qualification belong to the existing C3/C6 program. No runtime, default, index, credential or authority configuration changes.

Validation

• Tested revision: 48e77acb16b676fd9f6b4b599ce911c43d05b633.
• Run state: finished.
• Input classes: synthetic, public_fixture.

Check kind	Result	Evidence / limitation
static	passed	Staged and committed bilingual RFC gate, diff hygiene, new anchors/provider links, shared-tool diagram edges and Markdown fences
manual	passed	English/Chinese clause review; existing continuity and single-executor obligations preserved
static / integration	passed	Standard premerge's four direct checks, two catalog checks, eight selected risk-profile smokes and public-boundary scan, with the dependency recovery below
real_backend	not_applicable	Documentation only; runtime capabilities and effectiveness/cost benefits remain unqualified

The first premerge invocation failed its semantic-vocabulary check because this clean checkout lacked TypeScript dev dependencies. After installing the locked dependencies with npm ci --ignore-scripts, the exact failed check passed. Other selected checks had passed; the original dependency failure is not rewritten or treated as a runtime result.

Frontend / Visual Evidence

• UI impact: none. RFC prose and an existing architecture diagram change; no product UI or documentation chrome changes.
• Screenshots, viewports and preview: N/A.
• Source data: public_fixture.

Type of Change

• Documentation update

LoopX Area

• Public docs or presentation surface

Technical Direction

Existing controller–worker RFC C3, with §9 session-evidence and shared-environment acceptance.

Shared-authority RFC fixture impact

N/A: no runtime, storage, authority routing or provider promotion change.

Boundary Checklist

• Public-safe diff and body; no private state, credentials, raw traces, internal links or local machine paths.
• No duplicate benchmark execution.
• Scoped to the requested design clarification.
• English and Chinese RFC mirrors changed together; committed bilingual gate passed.
• UI impact marked none.
• Commit includes DCO sign-off.

[loopx-agent]

Reviewer: model_agent · gpt-6.1-sol · OpenAI · runtime_reported · max

本次评审对应提交 48e77acb16b676fd9f6b4b599ce911c43d05b633。

动机 / Motivation

为双角色 Host 实现或验收的维护者，以及按原会话读产物的 controller 操作者。既有 RFC 未说清 controller 怎样定位正在工作的 worker 会话，也未把双方用同一工作环境核验产物写入验收。实现时容易把历史命中当成当前事实，或在另一个 checkout 核验。双语 RFC 现在明确了真实绑定、授权内读证据、同环境双向读写及冲突负例，并把两项检查纳入 C3。现有交付状态不变。本次是设计文档评审。真实 Host 的发现、双向读写、冲突恢复与产品采用仍由 C3/C6 验收；未查询托管 CI。

改动思路 / Approach

Controller 先用现行绑定找原 attempt，再按权限读证据；共享普通工具不合并两个会话的基线或权限。

具体改动 / Changes

关键内容讲解

按 docs/architecture/rfcs/controller-executor-unified-contract-v0.md 的 809125511cad12db4fcd2c09bee999ec5ad2896c 版核对：C3-discovery 和 C3-workspace 已写入规范，C3-native-qualification 留给既有 C3/C6 的真实 Host 验收。

1. 发现与证据 明确原绑定、来源、时效和分页；历史命中不能证明正在执行。
2. 共享环境 规定同资源、版本和工具链，双方按角色授权；重叠写入先核原 attempt 并按已有规则交接。
3. 验收 要求原生双向读写、撤权和环境不匹配负例，并保留一次执行、一次结算。

对主干的风险 / Risks

无历史 provider 时仍可做基本会话发现；worker 忙时共享目录不授予接管或覆盖许可。两版文字都保留现有 Core 隔离、撤权与原 attempt 读回。

语义与 CI 对齐

新增锚点、相对链接、图连接、状态和 C3 出口逐项核对。双语 gate、4 项直接和 11 项选定 premerge 检查通过；主干候选只含这两份文档。

我的整体评价 / Verdict

APPROVE。文档补齐了可检验的边界，现行能力保持；新旅程仍需 C3/C6 验收。只改 RFC 文字及原架构图，没有产品首屏变化。新 native Host 旅程仍待验收。

English verdict: APPROVE. Both RFC mirrors specify scoped worker discovery and shared-workspace access without changing authority or claiming a shipped runtime.